EtwpCoverageEnsureUserModeView

NTSTATUS __stdcall EtwpCoverageEnsureUserModeView(INT64 a1){
  _EPROCESS *Process; 
  _PEB *Peb; 
  _ETHREAD *CurrentThread; 
  _DWORD *v4; 
  _EWOW64PROCESS *WoW64Process; 
  char v6; 
  UINT64 v8; 
  UINT64 Win32Protect; 
  int v10; 
  UINT64 CapturedViewSize; 
  _LARGE_INTEGER SectionOffset; 
  VOID *CapturedBase; 
  _EPROCESS *v14; 

  CapturedBase = 0i64;
  Process = KeGetCurrentThread()->ApcState.Process;
  v14 = Process;
  Peb = Process->Peb;
  if( Peb->TelemetryCoverageHeader )
  {
    v10 = 0;
  }
  else
  {
    SectionOffset.QuadPart = 0i64;
    CapturedViewSize = 0i64;
    LODWORD(Win32Protect) = 2;
    LODWORD(v8) = 0;
    v10 = MmMapViewOfSection(
            *(VOID **)(a1 + 8),
            Process,
            &CapturedBase,
            0i64,
            0i64,
            &SectionOffset,
            &CapturedViewSize,
            ViewShare,
            v8,
            Win32Protect);
    if( v10 >= 0 )
    {
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      --CurrentThread->Tcb.KernelApcDisable;
      ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)&ExBootDevicesRemovedEvent + 166, 0i64);
      qword_140C50300 = (__int64)KeGetCurrentThread();
      if( !Peb->TelemetryCoverageHeader )
      {
        Peb->TelemetryCoverageHeader = CapturedBase;
        CapturedBase = 0i64;
      }
      v4 = 0i64;
      WoW64Process = Process->WoW64Process;
      if( WoW64Process )
        v4 = WoW64Process->Peb;
      if( v4 )
        v4[279] = Peb->TelemetryCoverageHeader;
      v10 = 0;
    }
  }
  if( (struct _KTHREAD *)qword_140C50300 == KeGetCurrentThread() )
  {
    qword_140C50300 = 0i64;
    v6 = _InterlockedExchangeAdd64((_QWORD *)&ExBootDevicesRemovedEvent + 166, 0xFFFFFFFFFFFFFFFFui64);
    if( (v6 & 2) != 0 && (v6 & 4) == 0 )
      ExfTryToWakePushLock((_EX_PUSH_LOCK *)&ExBootDevicesRemovedEvent + 166);
    KeAbPostRelease((char *)&ExBootDevicesRemovedEvent + 1328);
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
  }
  if( CapturedBase )
    MiUnmapViewOfSection(Process, CapturedBase, 0i64);
  return v10;
}

Referenced by: